CVSS: 4.4EPSS: 0%CPEs: 618EXPL: 0CVE-2020-24507
https://notcve.org/view.php?id=CVE-2020-24507
Improper initialization in a subsystem in the Intel(R) CSME versions before 11.8.86, 11.12.86, 11.22.86, 12.0.81, 13.0.47, 13.30.17, 14.1.53, 14.5.32, 13.50.11 and 15.0.22 may allow a privileged user to potentially enable information disclosure via local access. Una inicialización inapropiada en un subsistema en Intel® CSME versiones anteriores a 11.8.86, 11.12.86, 11.22.86, 12.0.81, 13.0.47, 13.30.17, 14.1.53, 14.5.32, 13.50.11 y 15.0.22 puede habilitar a un usuario privilegiado para permitir potencialmente una divulgación de información por medio de un acceso local • https://cert-portal.siemens.com/productcert/pdf/ssa-309571.pdf https://security.netapp.com/advisory/ntap-20210611-0004 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00459.html • CWE-665: Improper Initialization •
CVSS: 8.8EPSS: 0%CPEs: 215EXPL: 0CVE-2020-24489 – hw: vt-d related privilege escalation
https://notcve.org/view.php?id=CVE-2020-24489
Incomplete cleanup in some Intel(R) VT-d products may allow an authenticated user to potentially enable escalation of privilege via local access. Una limpieza incompleta en algunos productos Intel® VT-d puede permitir a un usuario autenticado permitir potencialmente una escalada de privilegios por medio de un acceso local A flaw was found in Intel® VT-d products. Entries from the context cache on some types of context cache invalidations may not be properly invalidated which may allow an authenticated user to potentially enable escalation of privilege via local access. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. • https://lists.debian.org/debian-lts-announce/2021/07/msg00022.html https://www.debian.org/security/2021/dsa-4934 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00442.html https://access.redhat.com/security/cve/CVE-2020-24489 https://bugzilla.redhat.com/show_bug.cgi?id=1962650 • CWE-459: Incomplete Cleanup •
CVSS: 5.5EPSS: 0%CPEs: 12EXPL: 1CVE-2021-26314 – AMD Speculative execution with Floating-Point Value Injection
https://notcve.org/view.php?id=CVE-2021-26314
Potential floating point value injection in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution with incorrect floating point results, may cause the use of incorrect data from FPVI and may result in data leakage. Una inyección de valor de punto flotante potencial en todos los productos de CPU compatibles, junto con las vulnerabilidades de software relacionadas con la ejecución especulativa con resultados de punto flotante incorrectos, puede causar el uso de datos incorrectos de FPVI y puede resultar en una filtración de datos • http://www.openwall.com/lists/oss-security/2021/06/09/2 http://www.openwall.com/lists/oss-security/2021/06/10/1 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H36U6CNREC436W6GYO7QUMJIVEA35SCV https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVA2NY26MMXOODUMYZN5DCU3FXMBMBOB https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1003 • CWE-203: Observable Discrepancy CWE-208: Observable Timing Discrepancy •
CVSS: 5.5EPSS: 0%CPEs: 11EXPL: 0CVE-2021-26313 – AMD Speculative Code Store Bypass
https://notcve.org/view.php?id=CVE-2021-26313
Potential speculative code store bypass in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution of overwritten instructions, may cause an incorrect speculation and could result in data leakage. Una potencial omisión de almacenamiento de código especulativo en todos los productos de CPU compatibles, junto con las vulnerabilidades de software relacionadas con la ejecución especulativa de instrucciones sobrescritas, puede causar una especulación inapropiada y podría resultar en una filtración de datos • https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1003 • CWE-203: Observable Discrepancy CWE-208: Observable Timing Discrepancy •
CVSS: 4.4EPSS: 0%CPEs: 10EXPL: 0CVE-2020-24491
https://notcve.org/view.php?id=CVE-2020-24491
Debug message containing addresses of memory transactions in some Intel(R) 10th Generation Core Processors supporting SGX may allow a privileged user to potentially enable information disclosure via local access. El mensaje de depuración que contiene direcciones de transacciones de memoria en algunos Intel® 10th Generation Core Processors que admiten SGX puede permitir a un usuario privilegiado habilitar potencialmente una divulgación de información por medio de un acceso local • https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00455.html • CWE-20: Improper Input Validation •